4 ms·
You need to be able to run code on a machine. So server that you cannot log into isn’t vulnerable. This is for malware running as an executable or possible Java
by flatiron 4y ago
You need to be able to run code on a machine. So server that you cannot log into isn’t vulnerable. This is for malware running as an executable or possible JavaScript through the browser (maybe web assembly too)
- pantalaimon 4y agoBrowsers don’t expose the high accuracy time sources anymore that are needed for this attack.
- klabb3 4y agoSo can this be fixed by making it more difficult to measure time, either through CPU ticks or multithreaded measurements? Can it be a privileged operation to have high accuracy timing? IIRC cloudflare workers (a multi-tenant cloud environment) sets a static "current time" for each request and disallow multithreading to prevent accurate time measurements.